IPA encountered a DBus timeout when starting tracking of the CA subsystem certificates. It turned out that PK11_ListCertsInSlot() was sometimes taking 13-14 seconds to return. The hardcoded DBus timeout is just 25 seconds so generally things would fail if this occurred.

There is no reason to loop over all the certificates manually since PK11_FindCertFromNickname() will do that for us, including caching values. Some care is required to structure the nickname to distinguish between internal certificates and those on a different token but its straightforward.

This also fixes an NSS shutdown error discovered when reading keys due to not freeing an object.